I know the "logic" behind modern low password length limits for services like Paypal. Too many of their users are literally incapable of remembering their passwords and call/e-mail them bitching about how they're entering the right password and their account won't let them in and now they can't get to their money and bogus threats of legal action. So they encourage weak passwords and try to handle security on their side by flagging accounts for any reason and using 2FA. Recently they started requiring one number or special character in passwords, which puts them about 15 years behind the times when it comes to password policies.